RHONDA AVE S. VIVARES and SPS. MARGARITA and DAVID SUZARA v. ST.

THERESA'S
COLLEGE, MYLENE RHEZA T. ESCUDERO, and JOHN DOES.

G.R. No. 202666

September 29, 2014

Case:

Petition for Review on Certiorari under Rule 45 in re: Rule on the Writ of Habeas Data. Petitioners
assail the decision of RTC Cebu dismissing their habeas data petition.

Facts:

Nenita Julia V. Daluz (Julia) and Julienne Vida Suzara (Julienne), both minors, were graduating high
school students at St. Theresa's College (STC), Cebu City. Sometime in January 2012, while
changing into their swimsuits for a beach party they were about to attend, Julia and Julienne, along
with several others, took digital pictures of themselves clad only in their undergarments. These
pictures were then uploaded by Angela Lindsay Tan (Angela) on her Facebook3 profile.

Meanwhile, at the school - Mylene Rheza T. Escudero (Escudero), a computer teacher at STCs
high school department, learned from her students that some seniors at STC posted pictures online,
depicting themselves from the waist up, dressed only in brassieres. Escudero then asked her
students if they knew who the girls in the photos are. In turn, they readily identified Julia, Julienne,
and Chloe Lourdes Taboada (Chloe), among others.

Using STCs computers, Escuderos students logged in to their respective personal Facebook
accounts and showed her photos of the identified students, which include: (a) Julia and Julienne
drinking hard liquor and smoking cigarettes inside a bar; and (b) Julia and Julienne along the streets
of Cebu wearing articles of clothing that show virtually the entirety of their black brassieres. What is
more, Escuderos students claimed that there were times when access to or the availability of the
identified students photos was not confined to the girls Facebook friends, but were, in fact, viewable
by any Facebook user.

The matter was reported to Kristine Rose Tigol (Tigol), STCs Discipline-in-Charge, for appropriate
action and after investigations, it was found that they violated the schools student handbook for
possession of alcoholic drinks, engaging in immoral, indecent and lewd acts, smoking in pubic
places and for their apparel that exposes underwear and for uploading them on the internet.

Students involved were called to the Directress/Principals Office and the parents were informed,
that, as part of their penalty, they are barred from joining the commencement exercises scheduled
on March 30, 2012.

On March 23, 2012, Angelas mother, Dr. Armenia M. Tan (Tan), filed a Petition for Injunction and
Damages before the RTC of Cebu City to enjoin defendants from implementing the sanction.
Rhonda Ave Vivares (Vivares), the mother of Julia, joined the fray as an intervenor.

March 28, 2012, RTC issued a TRO allowing the students to attend the graduation ceremony. STC
filed an MR.
Despite the issuance of the TRO, STC, nevertheless, barred the sanctioned students from
participating in the graduation rites, arguing that, on the date of the commencement exercises, its
adverted motion for reconsideration on the issuance of the TRO remained unresolved.

Thereafter, petitioners filed before the RTC a Petition for the Issuance of a Writ of Habeas Data on
the basis of the following considerations: That the privacy settings were set to Friends Only thus
there is reasonable expectation of privacy; the use of the photos and access thereof was without
their consent; and illegally obtained in violation of the childrens rights to privacy, among other
considerations.

Petitioners contention: There was a breach of the minors privacy when Escudero intruded and
downloaded the photos from the private accounts of the students since the photos were not open for
public viewing. Also, the minors involved were not the ones who uploaded the photos.

Respondents contention: The students were the ones who showed the pictures to Escudero and as
stated, the photos were public, meaning these were not confined to their friends on Facebook.
(Evidentiary: statements of the students are not corroborated and self-serving not considered by
the Court.)

The RTC found the petition sufficient in form and substance, and through an order, the RTC issued a
writ of habeas corpus. In the same order, the respondents were directed to file their affidavits and
verified returns.

Contention of the Respondents:

The denial of the petition for the issuance of the writ based on the following grounds: (a) petitioners
are not the proper parties to file the petition; (b) petitioners are engaging in forum shopping; (c) the
instant case is not one where a writ of habeas data may issue;and (d) there can be no violation of
their right to privacy as there is no reasonable expectation of privacy on Facebook.

RTC Ruling:

Petitioners failed to prove the existence of an actual or threatened violation of the minors right to
privacy, which is one of the preconditions for the issuance of the writ of habeas data.

There was also no restrictions as to who may view the photos on Facebook, thus the minors lost
their privacy in some way.

In addition to that, STC gathered the photographs through legal means and for a legal purpose, that
is, the implementation of the schools policies and rules on discipline.

Because of this ruling, petitioners appealed the case with the Supreme Court.

Issue:

1. Whether or not a writ of habeas data should be issued.

2. Whether or not there was indeed an actual or threatened violation of the right to privacy in
the life, liberty, or security of the minors involved in this case.
SC Ruling:

The petition is not meritorious.

1. No. The [issuance of the] Writ of Habeas Data is not proper in this case.

What is the writ of habeas data?

The writ of habeas data is a remedy available to any person whose right to privacy in life, liberty or
security is violated or threatened by an unlawful act or omission of a public official or employee, or of
a private individual or entity engaged in the gathering, collecting or storing of data or information
regarding the person, family, home and correspondence of the aggrieved party.

It is an independent and summary remedy designed to protect the image, privacy, honor,
information, and freedom of information of an individual, and to provide a forum to enforce ones
right to the truth and to informational privacy. It seeks to protect a persons right to control
information regarding oneself, particularly in instances in which such information is being collected
through unlawful means in order to achieve unlawful ends.

The writ, however, will not issue on the basis merely of an alleged unauthorized access to
information about a person. Availment of the writ requires the existence of a nexus between the
right to privacy on the one hand, and the right to life, liberty or security on the other. Thus, the
existence of a persons right to informational privacy and a showing, at least by substantial evidence,
of an actual or threatened violation of the right to privacy in life, liberty or security of the victim are
indispensable before the privilege of the writ may be extended.

NOTE: Without an actionable entitlement in the first place to the right to informational
privacy, a habeas data petition will not prosper.

Important doctrines on Writ of Habeas Data:

1. The writ of habeas data is not only confined to cases of extralegal killings and enforced
disappearances. (Read Sec. 2 of Rules on Writ of Habeas Data Who may apply for the
writ.)
2. The writ of habeas data, however, can be availed of as an independent remedy to enforce
ones right to privacy, more specifically the right to informational privacy. The remedies
against the violation of such right can include the updating, rectification, suppression or
destruction of the database or information or files in possession or in control of respondents.
3. To be "engaged" in the gathering, collecting or storing of data or information, conveys the
idea that habeas data is a protection against unlawful acts or omissions of public officials
and of private individuals or entities engaged in gathering, collecting, or storing data
about the aggrieved party and his or her correspondences, or about his or her family. Such
individual or entity need not be in the business of collecting or storing data. Regularity
of the undertaking, be it business or personal, is immaterial and such will not prevent the writ
from getting to said person or entity.

2. No. There was no actual threat in the privacy of the minors in the photo. STC did not
violate petitioners daughters right to privacy.
In context: Online social network (OSN) is there a right to informational privacy in OSN activities of
its users?

a. The Right to Informational Privacy on Facebook [or social media in general] - the right of
individuals to control information about themselves.

The three strands of the right to privacy: (1) locational or situational privacy; (2) informational
privacy; and (3) decisional privacy.

Under the Philippine model of the writ of habeas data, the SC recognized that having an expectation
of informational privacy is not necessarily incompatible with engaging in cyberspace activities,
including those that occur in OSNs. Informational privacy also includes personal information.

b. Facebooks Privacy Tools: IMPORTANT DISCUSSIONS

On the concerns about privacy, Facebook was armed with different privacy tools designed to
regulate the accessibility of a users profile as well as information uploaded by the user. In H v. W,
the South Gauteng High Court recognized this ability of the users to "customize their privacy
settings." A Facebook user can regulate the visibility and accessibility of digital images(photos),
posted on his or her personal bulletin or "wall," except for the users profile picture and ID, by
selecting his or her desired privacy setting:

(a) Public - the default setting; every Facebook user can view the photo;
(b) Friends of Friends - only the users Facebook friends and their friends can view the
photo;
(b) Friends - only the users Facebook friends can view the photo;
(c) Custom - the photo is made visible only to particular friends and/or networks of the
Facebook user; and
(d) Only Me - the digital image can be viewed only by the user.

Before one can have an expectation of privacy in his or her OSN activity, it is first necessary that
said user, in this case the children of petitioners, manifest the intention to keep certain posts private,
through the employment of measures to prevent access thereto or to limit its visibility. And this
intention can materialize in cyberspace through the utilization of the OSNs privacy tools. In other
words, utilization of these privacy tools is the manifestation, in cyber world, of the users invocation
of his or her right to informational privacy.

Therefore, a Facebook user who opts to make use of a privacy tool to grant or deny access to his or
her post or profile detail should not be denied the informational privacy right which necessarily
accompanies said choice.

The court noted that Escudero did not apply special means to be able to view the allegedly private
accounts, so it is reasonable to assume, therefore, that the photos were, in reality, viewable either by
(1) their Facebook friends, or (2) by the public at large.

Considering that the default setting for Facebook posts is"Public," it can be surmised that the
photographs in question were viewable to everyone on Facebook, absent any proof that petitioners
children positively limited the disclosure of the photograph. If suchwere the case, they cannot invoke
the protection attached to the right to informational privacy.

That the photos are viewable by "friends only" does not necessarily bolster the petitioners
contention. In this regard, the cyber community is agreed that the digital images under this setting
still remain to be outside the confines of the zones of privacy. STC did not resort to any
unlawful means of gathering the information as it was voluntarily given to them by persons
who had legitimate access to the said posts.

Furthermore, petitioners failed to prove their contention that respondents reproduced and
broadcasted the photographs. Appending the photographs in the memorandum is not tantamount to
a violation of the minors informational privacy rights.

Without proof that they placed the photographs subject of this case within the ambit of their
protected zone of privacy, they cannot now insist that they have an expectation of privacy
with respect to the photographs in question.

Had it been proved that the access to the pictures posted were limited to the original
uploader, through the "Me Only" privacy setting, or that the users contact list has been
screened to limit access to a select few, through the "Custom" setting, the result may have
been different, for in such instances, the intention to limit access to the particular post,
instead of being broadcasted to the public at large or all the users friends en masse,
becomes more manifest and palpable.

FINAL RULING:

SC affirms the decision of RTC Cebu. STC and its officials did not violate the minors' privacy rights,
 ------FULL TEXT------
G.R. No. 202666 September 29, 2014

RHONDA AVE S. VIVARES and SPS. MARGARITA and DAVID SUZARA, Petitioners,
vs.
ST. THERESA'S COLLEGE, MYLENE RHEZA T. ESCUDERO, and JOHN DOES, Respondents.

DECISION

VELASCO, JR., J.:

The individual's desire for privacy is never absolute, since participation in society is an equally
powerful desire. Thus each individual is continually engaged in a personal adjustment process in
which he balances the desire for privacy with the desire for disclosure and communication of himself
to others, in light of the environmental conditions and social norms set by the society in which he
lives.

- Alan Westin, Privacy and Freedom (1967)

The Case

Before Us is a Petition for Review on Certiorari under Rule 45 of the Rules of Court, in relation to
Section 19 of A.M. No. 08-1-16-SC,1 otherwise known as the "Rule on the Writ of Habeas Data."
Petitioners herein assail the July 27, 2012 Decision2 of the Regional Trial Court, Branch 14 in Cebu
City (RTC) in SP. Proc. No. 19251-CEB, which dismissed their habeas data petition.

The Facts

Nenita Julia V. Daluz (Julia) and Julienne Vida Suzara (Julienne), both minors, were, during the
period material, graduating high school students at St. Theresa's College (STC), Cebu City.
Sometime in January 2012, while changing into their swimsuits for a beach party they were about to
attend, Julia and Julienne, along with several others, took digital pictures of themselves clad only in
their undergarments. These pictures were then uploaded by Angela Lindsay Tan (Angela) on her
Facebook3 profile.

Back at the school, Mylene Rheza T. Escudero (Escudero), a computer teacher at STCs high
school department, learned from her students that some seniors at STC posted pictures online,
depicting themselves from the waist up, dressed only in brassieres. Escudero then asked her
students if they knew who the girls in the photos are. In turn, they readily identified Julia, Julienne,
and Chloe Lourdes Taboada (Chloe), among others.

Using STCs computers, Escuderos students logged in to their respective personal Facebook
accounts and showed her photos of the identified students, which include: (a) Julia and Julienne
drinking hard liquor and smoking cigarettes inside a bar; and (b) Julia and Julienne along the streets
of Cebu wearing articles of clothing that show virtually the entirety of their black brassieres. What is
more, Escuderos students claimed that there were times when access to or the availability of the
identified students photos was not confined to the girls Facebook friends,4but were, in fact, viewable
by any Facebook user.5
Upon discovery, Escudero reported the matter and, through one of her students Facebook page,
showed the photosto Kristine Rose Tigol (Tigol), STCs Discipline-in-Charge, for appropriate action.
Thereafter, following an investigation, STC found the identified students to have deported
themselves in a manner proscribed by the schools Student Handbook, to wit:

1. Possession of alcoholic drinks outside the school campus;

2. Engaging in immoral, indecent, obscene or lewd acts;

3. Smoking and drinking alcoholicbeverages in public places;

4. Apparel that exposes the underwear;

5. Clothing that advocates unhealthy behaviour; depicts obscenity; contains sexually

suggestive messages, language or symbols; and 6. Posing and uploading pictures on the
Internet that entail ample body exposure.

On March 1, 2012, Julia, Julienne, Angela, and the other students in the pictures in question,
reported, as required, to the office of Sr. Celeste Ma. Purisima Pe (Sr. Purisima), STCs high school
principal and ICM6 Directress. They claimed that during the meeting, they were castigated and
verbally abused by the STC officials present in the conference, including Assistant Principal
Mussolini S. Yap (Yap), Roswinda Jumiller, and Tigol. What is more, Sr. Purisima informed their
parents the following day that, as part of their penalty, they are barred from joining the
commencement exercises scheduled on March 30, 2012.

A week before graduation, or on March 23, 2012, Angelas mother, Dr. Armenia M. Tan (Tan), filed a
Petition for Injunction and Damages before the RTC of Cebu City against STC, et al., docketed as
Civil Case No. CEB-38594.7In it, Tan prayed that defendants therein be enjoined from implementing
the sanction that precluded Angela from joining the commencement exercises.

On March 25, 2012,petitioner Rhonda Ave Vivares (Vivares), the mother of Julia, joined the fray as
an intervenor. On March 28, 2012, defendants inCivil Case No. CEB-38594 filed their memorandum,
containing printed copies of the photographs in issue as annexes. That same day, the RTC issued a
temporary restraining order (TRO) allowing the students to attend the graduation ceremony, to which
STC filed a motion for reconsideration.

Despite the issuance of the TRO,STC, nevertheless, barred the sanctioned students from
participating in the graduation rites, arguing that, on the date of the commencement exercises, its
adverted motion for reconsideration on the issuance ofthe TRO remained unresolved.

Thereafter, petitioners filed before the RTC a Petition for the Issuance of a Writ of Habeas Data,
docketed as SP. Proc. No. 19251-CEB8 on the basis of the following considerations:

1. The photos of their children in their undergarments (e.g., bra) were taken for posterity
before they changed into their swimsuits on the occasion of a birthday beach party;

2. The privacy setting of their childrens Facebook accounts was set at "Friends Only." They,
thus, have a reasonable expectation of privacy which must be respected.

3. Respondents, being involved in the field of education, knew or ought to have known of
laws that safeguard the right to privacy. Corollarily, respondents knew or ought to have
 known that the girls, whose privacy has been invaded, are the victims in this case, and not
the offenders. Worse, after viewing the photos, the minors were called "immoral" and were
punished outright;

4. The photos accessed belong to the girls and, thus, cannot be used and reproduced
without their consent. Escudero, however, violated their rights by saving digital copies of the
photos and by subsequently showing them to STCs officials. Thus, the Facebook accounts
of petitioners children were intruded upon;

5. The intrusion into the Facebook accounts, as well as the copying of information, data, and
digital images happened at STCs Computer Laboratory; and

6. All the data and digital images that were extracted were boldly broadcasted by
respondents through their memorandum submitted to the RTC in connection with Civil Case
No. CEB-38594. To petitioners, the interplay of the foregoing constitutes an invasion of their
childrens privacy and, thus, prayed that: (a) a writ of habeas databe issued; (b) respondents
be ordered to surrender and deposit with the court all soft and printed copies of the
subjectdata before or at the preliminary hearing; and (c) after trial, judgment be rendered
declaring all information, data, and digital images accessed, saved or stored, reproduced,
spread and used, to have been illegally obtained inviolation of the childrens right to privacy.

Finding the petition sufficient in form and substance, the RTC, through an Order dated July 5, 2012,
issued the writ of habeas data. Through the same Order, herein respondents were directed to file
their verified written return, together with the supporting affidavits, within five (5) working days from
service of the writ.

In time, respondents complied with the RTCs directive and filed their verified written return, laying
down the following grounds for the denial of the petition, viz: (a) petitioners are not the proper parties
to file the petition; (b) petitioners are engaging in forum shopping; (c) the instant case is not one
where a writ of habeas data may issue;and (d) there can be no violation of their right to privacy as
there is no reasonable expectation of privacy on Facebook.

Ruling of the Regional Trial Court

On July 27, 2012, the RTC rendered a Decision dismissing the petition for habeas data. The
dispositive portion of the Decision pertinently states:

WHEREFORE, in view of the foregoing premises, the Petition is hereby DISMISSED.

The parties and media must observe the aforestated confidentiality.

xxxx

SO ORDERED.9

To the trial court, petitioners failed to prove the existence of an actual or threatened violation of the
minors right to privacy, one of the preconditions for the issuance of the writ of habeas data.
Moreover, the court a quoheld that the photos, having been uploaded on Facebook without
restrictions as to who may view them, lost their privacy in some way. Besides, the RTC noted, STC
gathered the photographs through legal means and for a legal purpose, that is, the implementation
of the schools policies and rules on discipline.
Not satisfied with the outcome, petitioners now come before this Court pursuant to Section 19 of the
Rule on Habeas Data.10

The Issues

The main issue to be threshed out inthis case is whether or not a writ of habeas datashould be
issued given the factual milieu. Crucial in resolving the controversy, however, is the pivotal point of
whether or not there was indeed an actual or threatened violation of the right to privacy in the life,
liberty, or security of the minors involved in this case.

Our Ruling

We find no merit in the petition.

Procedural issues concerning the availability of the Writ of Habeas Data

The writ of habeas datais a remedy available to any person whose right to privacy in life, liberty or
security is violated or threatened by an unlawful act or omission of a public official or employee, or of
a private individual or entity engaged in the gathering, collecting or storing of data or information
regarding the person, family, home and correspondence of the aggrieved party.11 It is an independent
and summary remedy designed to protect the image, privacy, honor, information, and freedom of
information of an individual, and to provide a forum to enforce ones right to the truth and to
informational privacy. It seeks to protect a persons right to control information regarding oneself,
particularly in instances in which such information is being collected through unlawful means in order
to achieve unlawful ends.12

In developing the writ of habeas data, the Court aimed to protect an individuals right to informational
privacy, among others. A comparative law scholar has, in fact, defined habeas dataas "a procedure
designed to safeguard individual freedom from abuse in the information age."13 The writ, however,
will not issue on the basis merely of an alleged unauthorized access to information about a
person.Availment of the writ requires the existence of a nexus between the right to privacy on the
one hand, and the right to life, liberty or security on the other.14 Thus, the existence of a persons
right to informational privacy and a showing, at least by substantial evidence, of an actual or
threatened violation of the right to privacy in life, liberty or security of the victim are indispensable
before the privilege of the writ may be extended.15

Without an actionable entitlement in the first place to the right to informational privacy, a habeas
datapetition will not prosper. Viewed from the perspective of the case at bar,this requisite begs this
question: given the nature of an online social network (OSN)(1) that it facilitates and promotes
real-time interaction among millions, if not billions, of users, sans the spatial barriers,16 bridging the
gap created by physical space; and (2) that any information uploaded in OSNs leavesan indelible
trace in the providers databases, which are outside the control of the end-usersis there a right to
informational privacy in OSN activities of its users? Before addressing this point, We must first
resolve the procedural issues in this case.

a. The writ of habeas data is not only confined to cases of extralegal killings and enforced
disappearances

Contrary to respondents submission, the Writ of Habeas Datawas not enacted solely for the
purpose of complementing the Writ of Amparoin cases of extralegal killings and enforced
disappearances.
Section 2 of the Rule on the Writ of Habeas Data provides:

Sec. 2. Who May File. Any aggrieved party may file a petition for the writ of habeas data. However,
in cases of extralegal killings and enforced disappearances, the petition may be filed by:

(a) Any member of the immediate family of the aggrieved party, namely: the spouse, children
and parents; or

(b) Any ascendant, descendant or collateral relative of the aggrieved party within the fourth
civil degreeof consanguinity or affinity, in default of those mentioned in the preceding
paragraph. (emphasis supplied)

Had the framers of the Rule intended to narrow the operation of the writ only to cases of extralegal
killings or enforced disappearances, the above underscored portion of Section 2, reflecting a
variance of habeas data situations, would not have been made.

Habeas data, to stress, was designed "to safeguard individual freedom from abuse in the information
age."17 As such, it is erroneous to limit its applicability to extralegal killings and enforced
disappearances only. In fact, the annotations to the Rule preparedby the Committee on the Revision
of the Rules of Court, after explaining that the Writ of Habeas Data complements the Writ of Amparo,
pointed out that:

The writ of habeas data, however, can be availed of as an independent remedy to enforce ones
right to privacy, more specifically the right to informational privacy. The remedies against the
violation of such right can include the updating, rectification, suppression or destruction of the
database or information or files in possession or in control of respondents.18 (emphasis Ours) Clearly
then, the privilege of the Writ of Habeas Datamay also be availed of in cases outside of extralegal
killings and enforced disappearances.

b. Meaning of "engaged" in the gathering, collecting or storing of data or information

Respondents contention that the habeas data writ may not issue against STC, it not being an entity
engaged in the gathering, collecting or storing of data or information regarding the person, family,
home and correspondence of the aggrieved party, while valid to a point, is, nonetheless, erroneous.

To be sure, nothing in the Rule would suggest that the habeas data protection shall be available only
against abuses of a person or entity engaged in the businessof gathering, storing, and collecting of
data. As provided under Section 1 of the Rule:

Section 1. Habeas Data. The writ of habeas datais a remedy available to any person whose right
to privacy in life, liberty or security is violated or threatened by an unlawful act or omission of a public
official or employee, or of a private individual or entity engaged in the gathering, collecting or storing
of data or information regarding the person, family, home and correspondence of the aggrieved
party. (emphasis Ours)

The provision, when taken in its proper context, as a whole, irresistibly conveys the idea that habeas
data is a protection against unlawful acts or omissions of public officials and of private individuals or
entities engaged in gathering, collecting, or storing data about the aggrieved party and his or her
correspondences, or about his or her family. Such individual or entity need not be in the business of
collecting or storing data.
To "engage" in something is different from undertaking a business endeavour. To "engage" means
"to do or take part in something."19 It does not necessarily mean that the activity must be done in
pursuit of a business. What matters is that the person or entity must be gathering, collecting or
storing said data or information about the aggrieved party or his or her family. Whether such
undertaking carries the element of regularity, as when one pursues a business, and is in the nature
of a personal endeavour, for any other reason or even for no reason at all, is immaterial and such
will not prevent the writ from getting to said person or entity.

To agree with respondents above argument, would mean unduly limiting the reach of the writ to a
very small group, i.e., private persons and entities whose business is data gathering and storage,
and in the process decreasing the effectiveness of the writ asan instrument designed to protect a
right which is easily violated in view of rapid advancements in the information and communications
technologya right which a great majority of the users of technology themselves are not capable of
protecting.

Having resolved the procedural aspect of the case, We now proceed to the core of the controversy.

The right to informational privacy on Facebook

a. The Right to Informational Privacy

The concept of privacyhas, through time, greatly evolved, with technological advancements having
an influential part therein. This evolution was briefly recounted in former Chief Justice Reynato S.
Punos speech, The Common Right to Privacy,20 where he explained the three strands of the right to
privacy, viz: (1) locational or situational privacy;21(2) informational privacy; and (3) decisional
privacy.22 Of the three, what is relevant to the case at bar is the right to informational privacy
usually defined as the right of individuals to control information about themselves.23

With the availability of numerous avenues for information gathering and data sharing nowadays, not
to mention each systems inherent vulnerability to attacks and intrusions, there is more reason that
every individuals right to control said flow of information should be protected and that each
individual should have at least a reasonable expectation of privacy in cyberspace. Several
commentators regarding privacy and social networking sites, however, all agree that given the
millions of OSN users, "[i]n this [Social Networking] environment, privacy is no longer grounded in
reasonable expectations, but rather in some theoretical protocol better known as wishful thinking."24

It is due to this notion that the Court saw the pressing need to provide for judicial remedies that
would allow a summary hearing of the unlawful use of data or information and to remedy possible
violations of the right to privacy.25 In the same vein, the South African High Court, in its Decision in
the landmark case, H v. W,26promulgated on January30, 2013, recognized that "[t]he law has to take
into account the changing realities not only technologically but also socially or else it will lose
credibility in the eyes of the people. x x x It is imperative that the courts respond appropriately to
changing times, acting cautiously and with wisdom." Consistent with this, the Court, by developing
what may be viewed as the Philippine model of the writ of habeas data, in effect, recognized that,
generally speaking, having an expectation of informational privacy is not necessarily incompatible
with engaging in cyberspace activities, including those that occur in OSNs.

The question now though is up to whatextent is the right to privacy protected in OSNs? Bear in mind
that informational privacy involves personal information. At the same time, the very purpose of OSNs
is socializingsharing a myriad of information,27 some of which would have otherwise remained
personal.
b. Facebooks Privacy Tools: a response to the clamor for privacy in OSN activities

Briefly, the purpose of an OSN is precisely to give users the ability to interact and to stay connected
to other members of the same or different social media platform through the sharing of statuses,
photos, videos, among others, depending on the services provided by the site. It is akin to having a
room filled with millions of personal bulletin boards or "walls," the contents of which are under the
control of each and every user. In his or her bulletin board, a user/owner can post anythingfrom
text, to pictures, to music and videosaccess to which would depend on whether he or she allows
one, some or all of the other users to see his or her posts. Since gaining popularity, the OSN
phenomenon has paved the way to the creation of various social networking sites, includingthe one
involved in the case at bar, www.facebook.com (Facebook), which, according to its developers,
people use "to stay connected with friends and family, to discover whats going on in the world, and
to share and express what matters to them."28

Facebook connections are established through the process of "friending" another user. By sending a
"friend request," the user invites another to connect their accounts so that they can view any and all
"Public" and "Friends Only" posts of the other.Once the request is accepted, the link is established
and both users are permitted to view the other users "Public" or "Friends Only" posts, among others.
"Friending," therefore, allows the user to form or maintain one-to-one relationships with other users,
whereby the user gives his or her "Facebook friend" access to his or her profile and shares certain
information to the latter.29

To address concerns about privacy,30 but without defeating its purpose, Facebook was armed with
different privacy tools designed to regulate the accessibility of a users profile31 as well as information
uploaded by the user. In H v. W,32 the South Gauteng High Court recognized this ability of the users
to "customize their privacy settings," but did so with this caveat: "Facebook states in its policies that,
although it makes every effort to protect a users information, these privacy settings are not
foolproof."33

For instance, a Facebook user canregulate the visibility and accessibility of digital images(photos),
posted on his or her personal bulletin or "wall," except for the usersprofile picture and ID, by
selecting his or her desired privacy setting:

(a) Public - the default setting; every Facebook user can view the photo;

(b) Friends of Friends - only the users Facebook friends and their friends can view the
photo;

(b) Friends - only the users Facebook friends can view the photo;

(c) Custom - the photo is made visible only to particular friends and/or networks of the
Facebook user; and

(d) Only Me - the digital image can be viewed only by the user.

The foregoing are privacy tools, available to Facebook users, designed to set up barriers to broaden
or limit the visibility of his or her specific profile content, statuses, and photos, among others, from
another users point of view. In other words, Facebook extends its users an avenue to make the
availability of their Facebook activities reflect their choice as to "when and to what extent to disclose
facts about [themselves] and to put others in the position of receiving such confidences."34 Ideally,
the selected setting will be based on ones desire to interact with others, coupled with the opposing
need to withhold certain information as well as to regulate the spreading of his or her personal
information. Needless to say, as the privacy setting becomes more limiting, fewer Facebook users
can view that users particular post.

STC did not violate petitioners daughters right to privacy

Without these privacy settings, respondents contention that there is no reasonable expectation of
privacy in Facebook would, in context, be correct. However, such is not the case. It is through the
availability of said privacy tools that many OSN users are said to have a subjective expectation that
only those to whomthey grant access to their profile will view the information they post or upload
thereto.35

This, however, does not mean thatany Facebook user automatically has a protected expectation of
privacy inall of his or her Facebook activities.

Before one can have an expectation of privacy in his or her OSN activity, it is first necessary that
said user, in this case the children of petitioners,manifest the intention to keepcertain posts private,
through the employment of measures to prevent access thereto or to limit its visibility.36 And this
intention can materialize in cyberspace through the utilization of the OSNs privacy tools. In other
words, utilization of these privacy tools is the manifestation,in cyber world, of the users invocation of
his or her right to informational privacy.37

Therefore, a Facebook user who opts to make use of a privacy tool to grant or deny access to his or
her post orprofile detail should not be denied the informational privacy right which necessarily
accompanies said choice.38Otherwise, using these privacy tools would be a feckless exercise, such
that if, for instance, a user uploads a photo or any personal information to his or her Facebook page
and sets its privacy level at "Only Me" or a custom list so that only the user or a chosen few can view
it, said photo would still be deemed public by the courts as if the user never chose to limit the photos
visibility and accessibility. Such position, if adopted, will not only strip these privacy tools of their
function but it would also disregard the very intention of the user to keep said photo or information
within the confines of his or her private space.

We must now determine the extent that the images in question were visible to other Facebook users
and whether the disclosure was confidential in nature. In other words, did the minors limit the
disclosure of the photos such that the images were kept within their zones of privacy? This
determination is necessary in resolving the issue of whether the minors carved out a zone of privacy
when the photos were uploaded to Facebook so that the images will be protected against
unauthorized access and disclosure.

Petitioners, in support of their thesis about their childrens privacy right being violated, insist that
Escudero intruded upon their childrens Facebook accounts, downloaded copies ofthe pictures and
showed said photos to Tigol. To them, this was a breach of the minors privacy since their Facebook
accounts, allegedly, were under "very private" or "Only Friends" setting safeguarded with a
password.39 Ultimately, they posit that their childrens disclosure was only limited since their profiles
were not open to public viewing. Therefore, according to them, people who are not their Facebook
friends, including respondents, are barred from accessing said post without their knowledge and
consent. Aspetitioners children testified, it was Angelawho uploaded the subjectphotos which were
only viewable by the five of them,40 although who these five are do not appear on the records.

Escudero, on the other hand, stated in her affidavit41 that "my students showed me some pictures of
girls cladin brassieres. This student [sic] of mine informed me that these are senior high school
[students] of STC, who are their friends in [F]acebook. x x x They then said [that] there are still many
other photos posted on the Facebook accounts of these girls. At the computer lab, these students
then logged into their Facebook account [sic], and accessed from there the various photographs x x
x. They even told me that there had been times when these photos were public i.e., not confined to
their friends in Facebook."

In this regard, We cannot give muchweight to the minors testimonies for one key reason: failure to
question the students act of showing the photos to Tigol disproves their allegation that the photos
were viewable only by the five of them. Without any evidence to corroborate their statement that the
images were visible only to the five of them, and without their challenging Escuderos claim that the
other students were able to view the photos, their statements are, at best, self-serving, thus
deserving scant consideration.42

It is well to note that not one of petitioners disputed Escuderos sworn account that her students,
who are the minors Facebook "friends," showed her the photos using their own Facebook accounts.
This only goes to show that no special means to be able to viewthe allegedly private posts were ever
resorted to by Escuderos students,43 and that it is reasonable to assume, therefore, that the photos
were, in reality, viewable either by (1) their Facebook friends, or (2) by the public at large.

Considering that the default setting for Facebook posts is"Public," it can be surmised that the
photographs in question were viewable to everyone on Facebook, absent any proof that petitioners
children positively limited the disclosure of the photograph. If suchwere the case, they cannot invoke
the protection attached to the right to informational privacy. The ensuing pronouncement in US v.
Gines-Perez44 is most instructive:

[A] person who places a photograph on the Internet precisely intends to forsake and renounce all
privacy rights to such imagery, particularly under circumstances suchas here, where the Defendant
did not employ protective measures or devices that would have controlled access to the Web page
or the photograph itself.45

Also, United States v. Maxwell46 held that "[t]he more open the method of transmission is, the less
privacy one can reasonably expect. Messages sent to the public at large inthe chat room or e-mail
that is forwarded from correspondent to correspondent loses any semblance of privacy."

That the photos are viewable by "friends only" does not necessarily bolster the petitioners
contention. In this regard, the cyber community is agreed that the digital images under this setting
still remain to be outside the confines of the zones of privacy in view of the following:

(1) Facebook "allows the world to be more open and connected by giving its users the tools
to interact and share in any conceivable way;"47

(2) A good number of Facebook users "befriend" other users who are total strangers;48

(3) The sheer number of "Friends" one user has, usually by the hundreds; and

(4) A users Facebook friend can "share"49 the formers post, or "tag"50 others who are not
Facebook friends with the former, despite its being visible only tohis or her own Facebook
friends.

It is well to emphasize at this point that setting a posts or profile details privacy to "Friends" is no
assurance that it can no longer be viewed by another user who is not Facebook friends with the
source of the content. The users own Facebook friend can share said content or tag his or her own
Facebook friend thereto, regardless of whether the user tagged by the latter is Facebook friends or
not with the former. Also, when the post is shared or when a person is tagged, the respective
Facebook friends of the person who shared the post or who was tagged can view the post, the
privacy setting of which was set at "Friends."

To illustrate, suppose A has 100 Facebook friends and B has 200. A and B are not Facebook
friends. If C, As Facebook friend, tags B in As post, which is set at "Friends," the initial audience of
100 (As own Facebook friends) is dramatically increased to 300 (As 100 friends plus Bs 200
friends or the public, depending upon Bs privacy setting). As a result, the audience who can view
the post is effectively expandedand to a very large extent.

This, along with its other features and uses, is confirmation of Facebooks proclivity towards user
interaction and socialization rather than seclusion or privacy, as it encourages broadcasting of
individual user posts. In fact, it has been said that OSNs have facilitated their users self-tribute,
thereby resulting into the "democratization of fame."51Thus, it is suggested, that a profile, or even a
post, with visibility set at "Friends Only" cannot easily, more so automatically, be said to be "very
private," contrary to petitioners argument.

As applied, even assuming that the photos in issue are visible only to the sanctioned students
Facebook friends, respondent STC can hardly be taken to task for the perceived privacy invasion
since it was the minors Facebook friends who showed the pictures to Tigol. Respondents were
mere recipients of what were posted. They did not resort to any unlawful means of gathering the
information as it was voluntarily given to them by persons who had legitimate access to the said
posts. Clearly, the fault, if any, lies with the friends of the minors. Curiously enough, however, neither
the minors nor their parents imputed any violation of privacy against the students who showed the
images to Escudero.

Furthermore, petitioners failed to prove their contention that respondents reproduced and
broadcasted the photographs. In fact, what petitioners attributed to respondents as an act of
offensive disclosure was no more than the actuality that respondents appended said photographs in
their memorandum submitted to the trial court in connection with Civil Case No. CEB-38594.52 These
are not tantamount to a violation of the minors informational privacy rights, contrary to petitioners
assertion.

In sum, there can be no quibbling that the images in question, or to be more precise, the photos of
minor students scantily clad, are personal in nature, likely to affect, if indiscriminately circulated, the
reputation of the minors enrolled in a conservative institution. However, the records are bereft of any
evidence, other than bare assertions that they utilized Facebooks privacy settings to make the
photos visible only to them or to a select few. Without proof that they placed the photographs subject
of this case within the ambit of their protected zone of privacy, they cannot now insist that they have
an expectation of privacy with respect to the photographs in question.

Had it been proved that the access tothe pictures posted were limited to the original uploader,
through the "Me Only" privacy setting, or that the users contact list has been screened to limit
access to a select few, through the "Custom" setting, the result may have been different, for in such
instances, the intention to limit access to the particular post, instead of being broadcasted to the
public at large or all the users friends en masse, becomes more manifest and palpable.

On Cyber Responsibility

It has been said that "the best filter is the one between your childrens ears."53 This means that self-
regulation on the part of OSN users and internet consumers ingeneral is the best means of avoiding
privacy rights violations.54 As a cyberspace communitymember, one has to be proactive in protecting
his or her own privacy.55 It is in this regard that many OSN users, especially minors, fail.Responsible
social networking or observance of the "netiquettes"56 on the part of teenagers has been the concern
of many due to the widespreadnotion that teenagers can sometimes go too far since they generally
lack the people skills or general wisdom to conduct themselves sensibly in a public forum.57

Respondent STC is clearly aware of this and incorporating lessons on good cyber citizenship in its
curriculum to educate its students on proper online conduct may be mosttimely. Too, it is not only
STC but a number of schools and organizations have already deemed it important to include digital
literacy and good cyber citizenshipin their respective programs and curricula in view of the risks that
the children are exposed to every time they participate in online activities.58 Furthermore, considering
the complexity of the cyber world and its pervasiveness,as well as the dangers that these children
are wittingly or unwittingly exposed to in view of their unsupervised activities in cyberspace, the
participation of the parents in disciplining and educating their children about being a good digital
citizen is encouraged by these institutions and organizations. In fact, it is believed that "to limit such
risks, theres no substitute for parental involvement and supervision."59

As such, STC cannot be faulted for being steadfast in its duty of teaching its students to
beresponsible in their dealings and activities in cyberspace, particularly in OSNs, whenit enforced
the disciplinary actions specified in the Student Handbook, absenta showing that, in the process, it
violated the students rights.

OSN users should be aware of the risks that they expose themselves to whenever they engage
incyberspace activities. Accordingly, they should be cautious enough to control their privacy and to
1w phi 1

exercise sound discretion regarding how much information about themselves they are willing to give
up. Internet consumers ought to be aware that, by entering or uploading any kind of data or
information online, they are automatically and inevitably making it permanently available online, the
perpetuation of which is outside the ambit of their control. Furthermore, and more importantly,
information, otherwise private, voluntarily surrendered by them can be opened, read, or copied by
third parties who may or may not be allowed access to such.

It is, thus, incumbent upon internet users to exercise due diligence in their online dealings and
activities and must not be negligent in protecting their rights. Equity serves the vigilant. Demanding
relief from the courts, as here, requires that claimants themselves take utmost care in safeguarding
a right which they allege to have been violated. These are indispensable. We cannot afford
protection to persons if they themselves did nothing to place the matter within the confines of their
private zone. OSN users must be mindful enough to learn the use of privacy tools, to use them if
they desire to keep the information private, and to keep track of changes in the available privacy
settings, such as those of Facebook, especially because Facebook is notorious for changing these
settings and the site's layout often.

In finding that respondent STC and its officials did not violate the minors' privacy rights, We find no
cogent reason to disturb the findings and case disposition of the court a quo.

In light of the foregoing, the Court need not belabor the other assigned errors.

WHEREFORE, premises considered, the petition is hereby DENIED. The Decision dated July 27,
2012 of the Regional Trial Court, Branch 14 in Cebu City in SP. Proc. No. 19251-CEB is hereby
AFFIRMED.

No pronouncement as to costs.

SO ORDERED.